CVE-2026-46320: tap: free page on error paths in tap_get_user_xdp()
In the Linux kernel, the following vulnerability has been resolved:
tap: free page on error paths in tapgetuserxdp()
tapgetuserxdp() rejects a frame shorter than ETHHLEN with -EINVAL, and returns -ENOMEM when buildskb() fails. Both paths jump to the err label without freeing the page that vhostnetbuildxdp() allocated for the frame. tapsendmsg() discards the per-buffer return value and always returns 0, so vhosttxbatch() takes the success path and never frees the page; each rejected frame in a batch leaks one page-frag chunk.
Free the page on both error paths, before the skb is built. This is the tap counterpart of the same leak in tunxdpone().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46320?
CVE-2026-46320 has a severity rating of 7.4, categorized as high.
How do I fix CVE-2026-46320?
To fix CVE-2026-46320, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-46320?
CVE-2026-46320 affects Linux kernel versions prior to the fix implemented in subsequent releases.
What type of vulnerability is CVE-2026-46320?
CVE-2026-46320 is a memory management vulnerability due to improper handling of error paths in the tap_get_user_xdp function.
What are the potential impacts of CVE-2026-46320?
The potential impact of CVE-2026-46320 includes denial of service, as the vulnerability could allow for resource exhaustion from not freeing allocated memory.